InvestCloud
Senior Detection and Incident Response Engineer
- Compensation
- Not disclosed
- Location
- United States
- Work setup
- Remote
- Seniority
- Senior
- Employment
- Full time
- Experience
- Not specified
- Category
- Security
- Posted
Skills
Must have
- You hold yourself to a world-class standard, and it shows in everything you deliver.
- You are a self-starter. You find the work that matters and finish it without being asked.
- You care about this field beyond the job description. You keep learning and building on your own because you enjoy it, and you put in the extra effort when the mission calls for it.
- You bring drive, ambition, and a positive attitude to hard problems.
- You make the people around you better. You share what you know, you never make anyone feel small, and you let your work speak for itself.
Nice to have
- Digital forensics experience or certifications such as GCIH, GCFA, or GNFA.
- Experience in financial services or another regulated industry.
- Experience with anti-ransomware or deception technologies.
Full description
We are looking for a Senior Detection and Incident Response Engineer who can see an attack anywhere and stop it fast. You will own CrowdStrike, design the logging and monitoring that gives us complete visibility, and build automation that detects, contains, and remediates threats at machine speed without disrupting the business. When a real incident happens, you will lead the response with precision and keep leadership informed.
How you will provide meaningful contributions
- Own the CrowdStrike Falcon platform end to end, including policy, tuning, host tagging and grouping, Real Time Response, and Falcon Fusion workflows.
- Design detection coverage across endpoints, identity, cloud, network, firewall, email, and SaaS applications, and close the gaps that remain.
- Build automation that detects, contains, and remediates threats in seconds, with safeguards that prevent unintended business disruption.
- Lead technical incident response from first alert to closure, including containment, investigation, evidence, and lessons learned.
- Manage our managed detection and response (MDR) provider, tune its detections, and hold it to measurable service levels.
- Analyze system, firewall, identity, and application logs to find and confirm malicious activity.
- Write and test incident response playbooks, and run exercises with technical and business teams.
- Lead and develop detection and response engineers in the U.S. and India, and take part in the on-call rotation.
What success looks like in your first year
- We can see an attack in any part of our environment, and we know exactly where any remaining blind spots are and how we will close them.
- Common threats are detected and contained automatically, in seconds, without breaking anything the business depends on.
- Serious incidents are contained quickly and precisely, with clear updates to leadership.
- CrowdStrike and our managed detection partner are tuned and held to measurable results.
Basic qualifications for consideration
- Eight or more years of experience in detection engineering and incident response, including leading the response to real incidents.
- Expert-level CrowdStrike Falcon administration, including Falcon Fusion security orchestration, automation, and response (SOAR) workflows, Real Time Response, host grouping and tagging, and the Falcon APIs.
- Expert experience with managed detection and response (MDR), extended detection and response (XDR), and managed security service providers (MSSPs).
- Deep knowledge of Windows and Linux system logs, firewall logs, identity logs, and cloud audit logs, and how to use them to find an attacker.